1. Field of the Invention
The present invention relates to an in-vehicle electronic control apparatus incorporating a microprocessor and particularly to improvement of an in-vehicle electronic control apparatus, such as an engine control apparatus, which has a monitoring control circuit serially connected to the microprocessor in order to enhance the safety of the control.
2. Description of the Related Art
It is publicly known that, in an in-vehicle electronic control apparatus equipped with a microprocessor, a so-called question/answer-method abnormality determination unit is utilized in which, in order to always monitor whether or not the microprocessor functions normally, a monitoring control circuit is provided, the monitoring control circuit transmits question information to the microprocessor that serves as a main control circuit unit, the microprocessor sends answer information in response to the question information to the monitoring control circuit, and then the monitoring control circuit compares the sent answer information with correct-solution information that has preliminarily been provided and ascertains whether or not a normal answer has been obtained.
For example, a mutual monitoring method among a plurality of data processing devices, which is a method for mutually monitoring whether or not a plurality of data processing devices functions normally, has already been proposed (e.g., refer to Japanese Patent Laid-Open No. 2001-350735); the mutual monitoring method is characterized in that a plurality of question codes is prepared; a first data processing device sends any one of the plurality of question codes to a second data processing device; the second data processing device performs a predetermined calculation that has been preliminarily determined in accordance with the received question code and sends the actual calculation result to the first data processing device; and then the operations of the first and the second data processing device are monitored, based on the result of determination on whether or not the first data processing device has been able to receive the actual calculation result within a predetermined time period and the result of comparison between the content of the actual calculation result and a correct-solution calculation result that has been prepared in accordance with the received question code.
In the conventional method disclosed in Japanese Patent Laid-Open No. 2001-350735, the foregoing question code denotes a question number; letting n denote the question number, the calculation to be performed by the second data processing device is defined as [n+25+27+29+(n×210)+214+215]. As described above, the calculated data includes n; the correct-solution information corresponding to the question number is preliminarily stored as known information in the first data processing device. The conventional apparatus disclosed in Japanese Patent Laid-Open No. 2001-350735 is configured in such a way that the value of an error counter is increased or decreased, depending on whether or not the actual calculation result has been obtained within the predetermined time period and whether or not the actual calculation result has been correct, and a predetermined command is outputted when the value of the error counter exceeds a predetermined value.
Moreover, as another conventional apparatus, an electronic control apparatus incorporating a microprocessor, which periodically and alternatively implements part of a control program so as to perform an operation inspection while the engine is running, has been disclosed (e.g., refer to Japanese Patent Laid-Open No. 2005-31865), in which a monitoring control circuit unit sequentially transmits, through an inquiry packet, a great number of question items to a microprocessor that controls a group of electric loads in response to the contents of a nonvolatile program memory and the operation status of a group of input sensors, and compares the content of the reply from the microprocessor with correct-solution information so as to perform an abnormality determination; and the microprocessor diagnoses the cycle of reception of the inquiry packets so as to counter-monitor the monitoring operation of the monitoring control circuit unit.
The outline of the Q&A-method abnormality determination unit set forth with regard to the conventional apparatus disclosed in Japanese Patent Laid-Open No. 2005-31865 is as illustrated in FIG. 16. In FIG. 16, an electronic control apparatus 1 is configured with a main control circuit unit 2 incorporating a microprocessor 2a and a monitoring control circuit unit 3 serially connected to the main control circuit unit 2. The main control circuit unit 2 is configured in such a way as to respond to the operation statuses of a great number of input signals including input signals A, B, and C and output a great number of output signals including an output signal Y so as to drive and control the electric loads; the main control circuit unit 2 is configured in such a way that the control specification thereof is determined by the contents of a program memory 2b that collaborates with the microprocessor 2a. 
For example, a monitoring subject program 2c is configured in such a way as to calculate the output signal Y [=K×(A−B)+C], based on the input signals A, B, and C and a control constant K that is preliminarily stored in the program memory 2b. Simulated-calculation data 2f is stored in the program memory 2b; a table n that typifies data tables 1, 2, - - - , n in the simulated-calculation data 2f is configured with simulation constants An, Bn, and Cn corresponding to the control constant K and the input signals A, B, and C; however, the electronic control apparatus 1 is configured in such a way that the table to be utilized for the simulated calculation is randomly designated in an updating manner, in accordance with question information from the monitoring control circuit unit 3.
The electronic control apparatus 1 is configured in such a way that, for the monitoring subject program 2c, an input information switching unit 2d periodically designates the data table n instead of the input signal A, B, and C, and the calculation result Yn [=K×(An−Bn)+Cn] is periodically transmitted, as answer information, to the monitoring control circuit unit 3 by way of an output destination switching unit 2e. The electronic control apparatus 1 is configured in such a way that the correct-solution information corresponding to question information (a data table number for simulated calculation) is preliminarily stored in a correct-information storage memory 3b in the monitoring control circuit unit 3, and an abnormality determination unit 3a compares the answer information obtained from the main control circuit unit 2 with the correct-solution information so as to determine whether or not an abnormality exists. In addition, as the control program for performing the simulated calculation utilizing the data table, the monitoring subject program 2c may directly be utilized, or a copy program 2g, which is the monitoring subject program 2c written in a different address region of the program memory 2b, may be utilized.
Additionally, with regard to another conventional apparatus, a technology related to communication-abnormality detection utilizing an addition and subtraction tallying unit has been disclosed. The conventional electronic control apparatus is configured in such a way that first and second control circuit units that communicate with each other by the intermediary of a serial communication circuit are provided with respective first and second addition and subtraction unit; when a reception error occurs in each of the control circuit units, a variation value of 3 is added to the receiving-side addition and subtraction unit; and in the case of normal reception, a variation value of 1 is subtracted. The initial value of the addition and subtraction unit is set to 9; when the present value exceeds 11, first and second abnormality detection signals are generated, and then receiving-side addition and subtraction unit performs alarm display and initialization thereof and initializes and restarts the opposite control circuit unit. Thus, in the case where, when normal communication is being continued, a reception error occurs, retransmission processing can be performed up to three times; however, in the case where, due to a bad situation in the past, sufficient subtraction processing is not being performed, even only a one-time reception error causes an abnormality detection signal to be generated. Therefore, in the case of the occurrence of a sporadic communication error, too sensitive abnormality determination is avoided, and a fatal and continuous communication failure is rapidly detected (e.g., refer to Japanese Patent Laid-Open No. 2005-031993).
In the second control circuit unit disclosed in Japanese Patent Laid-Open No. 2005-031993 is provided with a second setting data memory in which part or all of various kinds of control constants, such as first and second variation values, a normal-side limit value, an abnormal-side limit value, and an initial value, which are dealt with in the second addition and subtraction unit, or part or all of various kinds of control constants, such as a reception-interval tolerance value and the like, which are utilized in a second communication error determination error, are stored; part or all of the various kinds of control constants are transmitted from and written in a program memory, provided in the first control circuit unit, by a periodic transmission unit.
In the conventional mutual monitoring method disclosed in Japanese Patent Laid-Open No. 2001-350735, an answer-information abnormality detected through the question/answer-method and a communication abnormality are not separated from each other, and even a communication abnormality is processed just as an answer-information abnormality detected through the question/answer-method; therefore, it has been a problem that processing upon the detection of an abnormality is not adequately performed. Moreover, the calculation equation for the simulated calculation is not related to input and output control; therefore, neither input and output control timing nor communication timing is taken into account.
Additionally, in the electronic control apparatus disclosed in Japanese Patent Laid-Open No. 2005-31865, an answer-information abnormality detected through the question/answer-method and a communication abnormality are synthesized and inputted to an error counter; therefore, it has been a problem that, in the case where the communication cycle is shorter than that of the question cycle, abnormality detection is performed in which priority is placed on a communication abnormality. Additionally, in the electronic control apparatus disclosed in Japanese Patent Laid-Open No. 2005-031865, because, for the communication with the monitoring control circuit unit, a start-stop synchronization method is adopted in which transmission and reception are performed in steps of several bits, input and output monitoring information and Q&A information are each transmitted and received in a divided manner at appropriate timings. Therefore, the cycles of the transmission and reception of the input and output monitoring information and the cycles of the transmission and reception of the Q&A information can arbitrarily be changed; however, it has been a problem that, for the transmission data and the reception data, address information for designating the storage destination of the data and command information for discriminating the contents of the transmission data and the reception data are required, whereby the amounts of the transmission data and the reception data increase and the start-stop synchronization method is not suitable for high-speed communication. Moreover, although an abnormality related to the Q&A information is detected, the communication of the input and output monitoring information is not described.
Still moreover, in the electronic control apparatus disclosed in Japanese Patent Laid-Open No. 2005-031993, abnormality determination through the Q&A-method is not described, and various kinds of constants that determine the performance of abnormality determination are stored in the first control circuit unit; it has been a problem that, because, upon the start of driving, these constants are required to be transmitted to the second control circuit unit, the initial operation is delayed.